HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

UAB Medicine Alerts 652 Patients of PHI Exposure

The UAB Medicine Viral Hepatitis Clinic in Birmingham, AL has experienced a breach of patients’ protected health information (PHI).

UAB Medicine uses flash drives to transfer data from its Fibroscan machine to a computer. On October 25, 2017, two flash drives were discovered to be missing. The portable storage devices contained a limited amount of PHI of 652 patients.

Information stored on the devices included first and last names, gender, birth dates, images and numbers relating to test results, medical diagnosis, names of referring physician, and the dates and times of the examination.

UAB Medicine has confirmed that no Social Security numbers, financial information, insurance details, addresses, or phone numbers were stored on the flash drives.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

An extensive search of Viral Hepatitis Clinic was conducted, but the flash drives could not be located. The investigation into the breach is continuing. It is not known whether the flash drives were accidentally disposed of, lost within the facility, or if they were stolen. UAB Medicine therefore cannot say whether the PHI on the devices has been viewed by unauthorized individuals.

The breach of PHI has prompted UAB Medicine to review its policies and procedures and measures have been implemented to prevent similar incidents from occurring in the future. All patients affected by the incident were notified of the breach by mail this week.

Due to the limited nature of data that was exposed, patients are not believed to face a high risk of identity theft and fraud. As a precaution, patients have been advised to monitor their credit reports for any sign of fraudulent activity.

Since the possibility of unauthorized access of PHI cannot be ruled out, UAB Medicine is also offering patients impacted by the incident 12 months of credit monitoring and reporting services without charge.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.